For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Service catalogue

The service catalogue is the collection of all your eHerkenning services. The services in the catalogue represent specific administrative functions or processes with eHerkenning, such as services to apply for a subsidy or manage parking permits. In the service catalogue, you can add and define multiple services.

When adding a service, you need to configure the service name, the level of assurance and the user attributes required by your use case. You can also provide additional information, for example a description with the service purpose.

This page guides you through the steps to configure the eHerkenning service catalogue and add a service in the Signicat Dashboard.

Prerequisites​

This guide assumes you have already completed the steps in the following guides:

  1. Initial preparations.
  2. Manage certificates.
  3. Add eHerkenning in the Dashboard.

Authentication settings​

Important

The Authentication settings must be configured before creating the service catalogue.

Before you can create a service in the service catalogue, you need to provide some information about your organisation in the Authentication settings. To do this:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > Settings.
  2. Scroll down to Metadata settings.
  3. Fill in the following required fields:
    • Organisation name
    • Organisation display name
    • Organisation URL
  4. Click Save to save the settings.
Important

The value of Organisation display name MUST match the organisation name in your PKIo certificate, which is derived from the Organisation name you provided in the Create a Certificate Signing Request step.

Organisation display name is visible to end-users

Note that the organisation display name you enter in the Settings > Metadata settings will be visible to the end-users during authentication.

Authentication settings

eHerkenning Service Catalogue​

After you have configured the Authentication settings, you need to set up your eHerkenning Service Catalogue.

About the Service Catalogue

A Service Catalogue holds information about your eHerkenning services and defines who has access to them.

Each service has a ServiceID that is made of an Organisational Identification Number (OIN, or Government Identification Number) and a service index. The OIN matches the value in your PKIo certificate.

How to add a service to the catalogue​

To add a new service to the service catalogue, do the following:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs and choose eHerkenning.
  2. In the eHerkenning configuration page, select Setup eHerkenning service catalogue.
  3. Select Add a service.
  4. Select eHerkenning as the service type. Note that depending on your use case you can choose between these types of service:
    • eHerkenning (used by Dutch organisations)
    • eIDAS (used by European citizens)
  5. Configure the service, as explained below in the eHerkenning service configuration.
  6. When you are ready, select Add to create the service.
Activation time

Once you add a new service, the changes need to propagate to the eHerkenning network. The process may take up to two hours. When the process is complete, you are ready to connect to the service.

eHerkenning service configuration​

The service configuration is comprised of four sections:

  • General
  • Certificates
  • User attributes
  • Requested attributes

Below you find more information about the fields in each category:

General​

  • Configure as portal service: Tick this box if your organisation has a web service portal that includes multiple eHerkenning services. When ticked, select the name of the portal service to include.

    • Select portal services: Select all the services to include in the configuration for your portal service.

  • Service index: Every service has an index to distinguish it from other services. The index value can be between 1 and 9999. Note that the 0 index is reserved for the portal function in eHerkenning.

  • Level of Assurance (LoA): Select the desired assurance level. Read more about which LoA to choose for your services.

  • Service name: Provide a proper and descriptive name for your service (max 64 characters). The service scope should be clear to the end-users. Make sure you use a unique service name to avoid confusion with other service names. For example, Apply for a parking permit.

    Service name guidelines

    It is important that you define a clear service name. For example, the names Department 1 or Municipality X may not be clear enough to the users, who should immediately understand the service purpose. For example, if your service is used to apply for a subsidy, name it Apply for a subsidy.

    For help with choosing a service name, contact us by creating a support ticket in the Signicat Dashboard or follow the instructions in the official eHerkenning - Handbooks and support.

  • Service description: Enter a short description about the scope and purpose of the service (max 1024 characters).

  • Service description URL: Provide a valid URL to your website. This is a link to a public page with additional information about the service and its purpose.

  • Support SSO: Tick this box to enable Single Sign On (SSO). This only applies for LoA lower than 4.

Certificate​
Note

This section is only available when you configure encrypted responses.

  • Certificate keyname: The name to help you identify the certificate.

  • Upload certificate: Drag and drop the certificate file or click Browse files to upload the (public) PKIo certificate that you want to use to decrypt the eHerkenning payload you receive from Signicat.

    PKIo certificate requirements

    To receive an encrypted response from Signicat, you must upload your (public) PKIo certificate. When you receive an encrypted response, you need to decrypt the payload in your application's backend using the private key corresponding to the PKIo certificate.

    Note that this PKIo certificate is specific to this task and, therefore, different from the PKIo certificate that you upload to establish a connection with eHerkenning.

To add more certificates, click + Add certificate. Then, configure the settings above for the new certificate.

User attributes​
  • I want to receive: Also known as Entity Concerned Types (ECTAs), these are an Identifier Set and are a combination of one or more identifying attributes. Individual identifiers possible in ECTA sets are: KvK, RSIN, BSN (if allowed), PseudoID, and Pseudo. eIDASLegalIdentifier is currently not yet supported by the EU countries. Here are all the possibilities and combinations per service type:
    • kvk (eH)
    • rsin (eH)
    • bsn (eH / eIDAS)
    • kvk+rsin (eH)
    • kvk+bsn (eH)
    • pseudo (eIDAS)
    • pseudoid (eIDAS)
    • bsn+pseudoid (eIDAS)
    • bsn+pseudo (eIDAS)
    • bsn+pseudoid+pseudo (eIDAS)
    • eidasLegalIdentifier (eIDAS)
  • + Add user attributes: Allows you to add alternative attributes to receive when an attribute you requested is not available.
  • Support branch offices: If you accept login transactions for branch offices the following applies:
    • You must also accept login transactions without branch office number.
    • You must respect the restriction to act only for a branch office, to ensure a legally valid legal act has been concluded.
    • You may not use the branch office to determine the location, only to determine the limits of the power of representation.
Requested attributes​
  • Attributes: Allows you to request additional attributes. For more information, visit the attribute catalogue (in Dutch). You can make attributes Mandatory or Optional. When you choose Mandatory, end-users will not be able to log in to your service if they refuse to or they cannot supply the requested attribute.
    Important

    Not all attributes supported by the authentication services or authorisation registries are available. Therefore, make sure to not set attributes that are optional to "Mandatory", since this might prevent a portion of users from logging in.

  • Purpose statements: When you request an attribute, you must provide a purpose statement to explain your end-users the reason for requesting such attribute.
  • Privacy policy URL: When you request an attribute, you must add a valid URL to your privacy policy. This is required by law and the content should follow EU privacy regulations.

For more information about the requirements together with advice about the service catalogue configuration, refer to the official manual (in Dutch).

To learn more about the service catalogue, see the eHerkenning official manual.

Set a default service​

You can set a service as your default service. By doing this, you automatically route all the authentication flows to the default service. Remember that you can override the default service by passing a parameter in the authentication request.

To set the default service, do the following:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
  2. Choose eHerkenning.
  3. In the eHerkenning configuration page in the Standard tab, expand the Default eHerkenning service dropdown menu and select the name of the service.
  4. Click Save to set the new default service.
How to override the default service

To override the default service in an authentication flow, you need to specify the service index as a parameter in the authorisation request.

You can find more about what query parameters to use with eHerkenning in the Attributes reference.

Next steps​

If you want to simulate how an authentication flow would look like, you can test your eHerkenning configuration in the Dashboard.

Test eHerkenning
Test an eHerkenning service in the Dashboard

When you have configured a service in the catalogue, you can connect your application to eHerkenning by using an authentication protocol.

5. Connect with an authentication protocol
Establish a connection with OIDC, SAML 2.0 or the Authentication API
On this page